Adding a custom "handler" to TCP/UDP input

[Damien_Dallimor]

Does such a facility exist within SPLUNK by which you can add a custom "handler" to a TCP or UDP socket input ?

Such a scenario might be where you want to send data to SPLUNK via TCP, and this data might be a proprietary layer 4 network protocol that requires a custom handler to first decode the raw protocol bytes into a textual format before passing on to SPLUNK indexing.

I could quite easily write a "scripted input" that listens on a socket and outputs decoded bytes to STDOUT, but it would be nice if I could just write a custom "handler" that chains onto a standard TCP input.

Regards,

Damien D.

[Damien_Dallimor]

Thanks guys..I think I'll go with the scripted input proxying on to a Splunk socket input.

Damien D.

[dwaddle]

Hi Damien, don't forget to "accept" an answer by clicking the outlined check-mark to the left of it.

[araitz · Accepted solution]

Just write a scripted input, especially if you are confident that you can do it. What is the difference between that and a custom handler?

In general, your handler will provide the bottleneck, so the underlying TCP and UDP sockets don't really buy you anything.

If you just must use Splunk's sockets, have your scripted input listen on one port, do your decoding, and send the plain-text stream to a Splunk socket listening on another port.

[dwaddle]

Such a facility does not exist at this time. At least, not that is accessible to us customers. Splunk may have such a technique they use internally - but I don't think they expose any kind of API for us to get at it.

If this is something you want Splunk to consider you should submit an ER for it.

http://splunk-base.splunk.com/answers/4844/how-can-i-submit-an-enhancement-request